Messages in this thread | | | Date | Fri, 04 Dec 2015 16:37:53 -0500 (EST) | Subject | Re: bpf: undefined shift in __bpf_prog_run | From | David Miller <> |
| |
From: Alexei Starovoitov <alexei.starovoitov@gmail.com> Date: Fri, 4 Dec 2015 12:35:23 -0800
> On Fri, Dec 04, 2015 at 08:48:57PM +0100, Dmitry Vyukov wrote: >> >> For example, a compiler can assume that result of left shift is larger >> or equal to first operand, which in turn can allow it to elide some >> bounds check in code, which in turn can lead to an exploit. I am not >> saying that this particular pattern is present in the code, what I >> want to say is that such undefined behaviors can lead to very >> unpredictable and unexpected consequences. > > Within bpf it cannot. > shift is not used in any memory or bounds operations. > so reg <<= 1234 cannot be exploited.
+1
| |